CVE-2026-19220: Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation
The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Forminator Forms (WordPress plugin)to a version that resolves this vulnerability.Fixed in 1.57.1 - Compensating control
On the WordPress multisite network, ensure site registration is disabled/enforced according to network settings so unauthenticated visitors cannot create new sites before the plugin is upgraded.
Event History
Frequently Asked Questions
Which deployments are exposed?
WordPress multisite networks using Forminator Forms versions before 1.57.1 are exposed. The issue concerns creation of site signups on the network.
Does an attacker need an account or existing privileges?
No. An unauthenticated visitor can exploit the issue to create a new site and obtain administrator privileges for that site.
Is a network affected only when site registration is enabled?
No. The vulnerable plugin does not verify whether site registration is enabled before creating a site signup, so disabled network site registration does not prevent this behavior in affected versions.
What version resolves the issue?
Update Forminator Forms to version 1.57.1 or later.